India is accelerating its adoption of digital systems across critical sectors. However, this shift comes with a hefty price – growing cyber vulnerability threats. The risk of targeted disruptions, data theft and system sabotage is becoming more real and widespread than ever.
Driving digital inclusion and ensuring cybersecurity
In the transportation sector, for example, defences have not been keeping pace. Legacy control systems like supervisory control and data acquisition (SCADA) and programmable logic controllers that are used in railways, bridges and ports are vulnerable to cyberattacks, widening with the deployment of every new internet of thing (IoT) device, such as traffic cameras, tolling sensors and vehicle tracking units. In railways, while e-ticketing, smart sensors and automated signalling are a routine, the backend remains fragile. A breach in 2024, in the IRCTC insurance portal, where unauthorised users could access and alter passenger data without OTP verification, exposed how easy it is to infiltrate the security layer. Taking this into consideration, RailTel partnered with Cylus in 2024 to harden railway SCADA and signalling systems.
The highways are no exception when it comes to cyberattacks. Tolling systems like FASTag and automatic number plate recognition-based traffic monitoring rely on connected software, making it vulnerable to attacks. For example, investigations in early 2025 revealed manipulated code at over 200 toll plazas across 14 states, re-routing the National Highways Authority of India’s revenue into private accounts.
In the logistics sector, several warehousing and fleet aggregating companies have migrated to cloud tools for speed and scalability. However, many have skipped the basics. In 2025, Agarwal Packers and Movers Limited reported a serious data breach where customer information, including addresses and phone numbers, was stolen from its database.
Airports, with their air-gapped air traffic control systems, have traditionally been safer. Yet, they are still not immune. As biometric boarding, airline database integration, automatic vending and logistics system management become more digital, new vulnerabilities emerge. As per an industry report, around 66 per cent of airlines and 73 per cent of airports have placed cybersecurity among their top three priorities. In a positive development, the Cochin International Airport is setting a benchmark. It now runs a dedicated Cyber Defense Operations Centre, offering 24/7 monitoring and incident response integration.
Infrastructure development-wise, the smart city push adds another layer of complexity. Over 100 cities under the Smart Cities Mission now run real-time digital monitoring systems for traffic, water, air and surveillance. When the Indian Computer Emergency Response Team (CERT-In) and Kaspersky reviewed 20 of them, they found a worrying pattern of default admin credentials, outdated firmware and misconfigured simple network management protocol settings. Following this, in March 2025, CERT-In released guidelines on smart city architecture, mandating IoT hardware, network segmentation and incident response planning.
Water infrastructure is another weak link. Cities are now using SCADA-based telemetry to manage plants and reservoirs. However, malware could tweak chemical dosing levels. Tampered telemetry could misreport dam levels or trigger false alarms. In 2025, CloudSEK, an artificial intelligence (AI)-based cybersecurity firm, uncovered a major breach in Bangalore Water Supply and Sewerage Board’s (BWSSB) systems.
Telecom is also one of the most targeted sectors. In mid-2024, Bharat Sanchar Nigam Limited suffered a major breach when a hacker leaked 278 GB of data in its history, including SIM credentials, Home Location Register logs, International Mobile Subscriber Identity numbers, etc. Telecom service providers are now finally stepping in. Bharti Airtel, for instance, launched a cyber threat simulation lab in collaboration with Cisco in 2025. By mid-year, it had rolled out AI-powered threat detection across its packet core, focusing on real-time anomaly spotting and lateral movement. The new Telecom Act, 2023, has also introduced stronger regulatory enforcement. It defines critical telecom infrastructure and makes vulnerability disclosures, attack surface mapping and country-of-origin tagging of equipment mandatory. Parallelly, CERT-In has also ramped up drills across sectors. As of mid-2025, it has conducted 109 cybersecurity mock exercises.
Mapping future potential
India’s infrastructure cybersecurity strategy, while evolving, is mostly reactive and scattered across sectors. What is missing is systemic cohesion – a unified framework that ties together transport, utilities, smart cities and telecom under a common security standard.
The threat landscape will only get more complex. As per an industry report, if left unaddressed, India could be facing close to a trillion cyberattacks a year by 2033. As per another industry report, India’s security software market is projected to grow at a CAGR of 18.5 per cent between 2022 and 2027, driven by rising investments in data protection; endpoint security; identity and access management; governance, risk and compliance tools; and security analytics. This surge reflects how cybersecurity is shifting from reactive patchwork to more integrated, software-driven strategies. However, more spending does not automatically translate to resilience. The real test lies in securing legacy systems without stalling innovation, enforcing compliance across state-run and private entities, and building cyber response mechanisms that work in real time.